agenttesla | 18685cc299f03f907413c789321ea1131326fec4a71de97194814685ba0dba38

General

Target

Bank Copy 022824001.pdf.exe
Size

703KB
MD5

c56407abd66f8bb4eaa318e56f464f71
SHA1

134d8ad6789d8c500005754da686ddc7d46e92d1
SHA256

18685cc299f03f907413c789321ea1131326fec4a71de97194814685ba0dba38
SHA512

6f52056d194dcaedba67bf2f29a7036e4172008085ee6cd1c0734077801c28c961501d1c535cd3bb7086c08cf7ffc29de9098770dbe93bd382554242a0ae07cc
SSDEEP

12288:vW+L9bW9ezd6Ztw4C8zFVK52RoA5UCWEFElQ+Nij2DGoNHJqCf9OK96bkR:vbL9iyYnRC8zA26A5hxOlQ+cCJNHgKE+

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.ronaldsmith.loan
Port:
587
Username:
[email protected]
Password:
BillionPay$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2616	2212	Bank Copy 022824001.pdf.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3028	powershell.exe
2640	powershell.exe
2616	Bank Copy 022824001.pdf.exe
2616	Bank Copy 022824001.pdf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2616	Bank Copy 022824001.pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2616	Bank Copy 022824001.pdf.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3028	2212	Bank Copy 022824001.pdf.exe	28
PID 2212 wrote to memory of 3028	2212	Bank Copy 022824001.pdf.exe	28
PID 2212 wrote to memory of 3028	2212	Bank Copy 022824001.pdf.exe	28
PID 2212 wrote to memory of 3028	2212	Bank Copy 022824001.pdf.exe	28
PID 2212 wrote to memory of 2640	2212	Bank Copy 022824001.pdf.exe	30
PID 2212 wrote to memory of 2640	2212	Bank Copy 022824001.pdf.exe	30
PID 2212 wrote to memory of 2640	2212	Bank Copy 022824001.pdf.exe	30
PID 2212 wrote to memory of 2640	2212	Bank Copy 022824001.pdf.exe	30
PID 2212 wrote to memory of 2624	2212	Bank Copy 022824001.pdf.exe	32
PID 2212 wrote to memory of 2624	2212	Bank Copy 022824001.pdf.exe	32
PID 2212 wrote to memory of 2624	2212	Bank Copy 022824001.pdf.exe	32
PID 2212 wrote to memory of 2624	2212	Bank Copy 022824001.pdf.exe	32
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34
PID 2212 wrote to memory of 2616	2212	Bank Copy 022824001.pdf.exe	34

C:\Users\Admin\AppData\Local\Temp\Bank Copy 022824001.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Copy 022824001.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank Copy 022824001.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nvLQFOOBRNypY.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nvLQFOOBRNypY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A4E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\Bank Copy 022824001.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Copy 022824001.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7A4E.tmp

Filesize
1KB

MD5
ff0a953a3db3cf11a887d2b8088ef5b4

SHA1
d9a1048e71ce919f33c5034b7aebe105607143d6

SHA256
39ba6d0df20b694d1985f40bb8eae7b4687d3faba60756e5b7271ae360bda5f5

SHA512
e9d7f987af5401cce797ac2f760720eaf1b5957f2be5007cabb2adc99b0616dfb8893aebc69f6fb1b2b45642a49bec17f51e118b7d742a3138b7036fb4a9d921

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c545aca9b2aa76972bf6f3cb7e7ea3b1

SHA1
aae8650adbf4d7ba2a5443b41d0d760adbe3b089

SHA256
9518c38f34198f7acbacdb94382231b76bba68a23cad3f25f50ceb2cdad962e4

SHA512
8fde65d585e2b5bab75fa2cdfe0645a9be02ed98fedf647d40a8c71942d1dc565c0e01a39843ec902854930c284fab4c24b09c0dc9d137ed6e6ec788b2abab67

Download Submit
memory/2212-34-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-1-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-2-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/2212-3-0x0000000000A10000-0x0000000000A2C000-memory.dmp

Filesize
112KB

Download
memory/2212-4-0x00000000008F0000-0x00000000008FC000-memory.dmp

Filesize
48KB

Download
memory/2212-5-0x0000000000A30000-0x0000000000A42000-memory.dmp

Filesize
72KB

Download
memory/2212-6-0x0000000005990000-0x0000000005A14000-memory.dmp

Filesize
528KB

Download
memory/2212-0-0x0000000000BD0000-0x0000000000C82000-memory.dmp

Filesize
712KB

Download
memory/2616-38-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-47-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2616-46-0x0000000073910000-0x0000000073FFE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-35-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-43-0x0000000073910000-0x0000000073FFE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2616-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2640-33-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2640-39-0x000000006F940000-0x000000006FEEB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-40-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2640-42-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2640-45-0x000000006F940000-0x000000006FEEB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-28-0x000000006F940000-0x000000006FEEB000-memory.dmp

Filesize
5.7MB

Download
memory/3028-41-0x0000000002290000-0x00000000022D0000-memory.dmp

Filesize
256KB

Download
memory/3028-37-0x000000006F940000-0x000000006FEEB000-memory.dmp

Filesize
5.7MB

Download
memory/3028-44-0x000000006F940000-0x000000006FEEB000-memory.dmp

Filesize
5.7MB

Download
memory/3028-31-0x000000006F940000-0x000000006FEEB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads